OpenDime or Hardware Wallet?

[Abiky]

There's this thing called the "OpenDime" which claims to be some sort of "Bitcoin Credit Stick". You can carry it around anywhere, pass it along to your friends, without compromising the integrity of the funds contained herein. You'd know that an "OpenDime" wallet's funds have been redeemed if its tamper-evident seal (in this case by unsealing the device with a Push Pin) is broken. They also have a Litecoin version at an affordable price than a regular hardware wallet like the Trezor or the Ledger Nano S.

I'd like to know which is better to use (OpenDime or hardware wallet) for day-to-day transactions? I've been using a hardware wallet for a long time now, but the "OpenDime" seems to be quite an attractive option for storing Bitcoin safely without breaking the bank. Of course, hardware wallets like the CoolWallet S or the Ledger Nano S provide a wide-variety of cryptocurrencies to choose from (unlike the "OpenDime" which is purposed for one coin at a time). But if it proves to be a great alternative to hardware wallets, I'd think most crypto users would go this route since it's the cheapest option to store (and spend) crypto anytime, anywhere.

What are your thoughts? Is this worth it? Or am I better off using a hardware wallet?

[TravelMug]

For the record here is OpenDime Ann thread, [ANN] OPENDIME v3 – Now *Genuine Verified* Bitcoin Credit Stick (in stock!).

Personally, I haven't used OpenDime, so I still prefer Electrum or my local exchanges (coins.ph) for day-to-day transactions, I won't use my hardware wallet for that purpose though.

Of course, there's always this sort of  malfunction" at the back of our mind, and as an electronic devices, there is the question of its life expectancy..

What is the expected lifetime of the device?

Like most electronic devices, if stored properly it should last decades.

The expected reliability of the part that stores the private key as described on the ATSAMD21E17 datasheet is between 25-100 years [page 1014]

For long term HODL/Storage and large amounts we recommend COLDCARD Hardware Wallet a ultra-secure Bitcoin wallet also made by us.

https://opendime.com/faq

So that's 25 to 100 years, assuming you do really protect the device and prevent it from accidental loss. i.e. plugging it to a bad USB port.


Here is a guy who have been carrying OpenDime for over a year:

Source: https://twitter.com/piramida/status/1226068815533891584

[joniboini]

It depends on what you need. If you don't need hand-to-hand or offline transactions I guess hardware wallet like Ledger Nano S is fine.

https://opendime.com/faq give a good explanation of what's the product is useful for.

[hatshepsut93]

OpenDime is not a wallet, so it's a bit wrong to compare it with a hardware wallet, since they are created to solve different tasks. Opendime is more close to a paper wallet, you can store Bitcoin on it, but you can't make transactions with it, you'd need to connect it to a computer and sweep the private key. Basically, Opendime is a sophisticated USB stick. There's no reason to get Opendime if you don't plan to use its main feature - transacting Bitcoin physically by giving someone your Opendime.

Hardware wallet allows you to securely store and transact Bitcoin, which is very useful for newbies who want a quick and simple solution to managing their coins.

[xvids]

OpenDime is not a wallet, so it's a bit wrong to compare it with a hardware wallet, since they are created to solve different tasks. Opendime is more close to a paper wallet, you can store Bitcoin on it, but you can't make transactions with it, you'd need to connect it to a computer and sweep the private key. Basically, Opendime is a sophisticated USB stick. There's no reason to get Opendime if you don't plan to use its main feature - transacting Bitcoin physically by giving someone your Opendime.

Hardware wallet allows you to securely store and transact Bitcoin, which is very useful for newbies who want a quick and simple solution to managing their coins.

I agree this is like comparing Bitcoin to Gold or other things.
Both have different use and each of them stands out in their own features.
For OP I don't think you really need an Opendime you could easily use your hardware wallet for your transactions.

[squatter]

I'd like to know which is better to use (OpenDime or hardware wallet) for day-to-day transactions? I've been using a hardware wallet for a long time now, but the "OpenDime" seems to be quite an attractive option for storing Bitcoin safely without breaking the bank.

OpenDimes and similar devices are most useful as bearer instruments -- literally passed around as cash, without transacting on the blockchain at all. If you want to transact over the blockchain, you need to break the device to sweep the private key.

So, hardware wallets serve a very different purpose. Apples and oranges.

I would also caution against using OpenDimes for large amounts or long term storage, since their design makes it impossible to securely back up the private key.

[o_e_l_e_o]

I'd think most crypto users would go this route since it's the cheapest option to store (and spend) crypto anytime, anywhere.

It is not the cheapest option to spend, though. Although you can send bitcoin to your Opendime as much as you want (because it will show you the public address when you plug it in to a computer), if you want to spend the bitcoin on it you have to break it to reveal the private key. Once you've done that, what you've essentially got is no more secure than just storing a private key on a normal USB stick i.e. not secure at all. Given that each one costs $15, you are paying $15 per transaction, and any change from your transaction would need to be sent to a new Opendime.

The physical security of the device is also massively inferior to that of a hardware wallet. A simple pin push is all that is needed to expose the private key. Anyone who steals your Opendime will be able to access the coins inside within a matter of seconds.

And as squatter says, it is impossible to back up without first breaking it to view the private key, in which case you have defeat its very purpose.

Opendimes serve a particular niche - transacting bitcoin in person without broadcasting a transaction. They are absolutely not a hardware wallet and should not be used as such.

[bitmover]

Opendimes serve a particular niche - transacting bitcoin in person without broadcasting a transaction. They are absolutely not a hardware wallet and should not be used as such.

Exactly
Opendimes are not much better than a mobile wallet imo.
Using a good mobile wallet you can make a lot of transactions very fast. You can use QR codes.. don't need to be carrying an extra device (like open dime) ... as neither of them are as safe as a hardware wallet, they should be used for small amounts of money only.

[Abiky]

For the record here is OpenDime Ann thread, [ANN] OPENDIME v3 – Now *Genuine Verified* Bitcoin Credit Stick (in stock!).

Personally, I haven't used OpenDime, so I still prefer Electrum or my local exchanges (coins.ph) for day-to-day transactions, I won't use my hardware wallet for that purpose though.

Of course, there's always this sort of  malfunction" at the back of our mind, and as an electronic devices, there is the question of its life expectancy..

...

So that's 25 to 100 years, assuming you do really protect the device and prevent it from accidental loss. i.e. plugging it to a bad USB port.

Wow. Never thought that OpenDime would be capable of lasting a very long time. 100 years is more than enough to preserve your crypto balance for future generations to enjoy. While it's not as comparable as a hardware wallet, it makes a great little tool for sending Bitcoin to anyone just as you would with physical cash. And for the price, I'd say that it's worth every penny. The only downside is that the OpenDime works with one cryptocurrency at a time. If the company ever decides to create a new version of the OpenDime that would serve as a "multi-currency" bearer bond stick, it would be a blast. Yet, we're only limited to BTC and LTC versions of the OpenDime stick.

For large amounts of money (crypto), it's best to go for a hardware wallet like Trezor or Ledger Nano S to protect your investment for the long term. The OpenDime would only serve for quick transfers of crypto in small increments. Putting your entire life savings on it, would not be the wisest thing to do.

OpenDimes and similar devices are most useful as bearer instruments -- literally passed around as cash, without transacting on the blockchain at all. If you want to transact over the blockchain, you need to break the device to sweep the private key.

So, hardware wallets serve a very different purpose. Apples and oranges.

I would also caution against using OpenDimes for large amounts or long term storage, since their design makes it impossible to securely back up the private key.

Yes. I've figured that it's impossible to back up the private key for safekeeping. Sensitive information is not released from the device unless you "break it". And doing this will expose your private key to the public. The OpenDime is very similar to a paper wallet in this regard, as once you "break the seal" you cannot reuse the device for your own benefit. But it's a great option for those looking for a safe and secure way of transferring (or even storing) Bitcoin or Litecoin offline.

I've decided to have both a hardware wallet and an OpenDime for safekeeping. For storing large amounts of crypto, a hardware wallet will suffice. But I could use an OpenDime to send money to my friends just as I would with ordinary cash. It's looks more suitable as a sort of "Bitcoin gift card" than anything else. For $15, I'd say that it's quite an affordable little device for sending Bitcoin anytime, anywhere in a completely offline manner.

[igor72]

For hand-to-hand transactions I would prefer Tangem card. It's cheaper and reusable.

[o_e_l_e_o]

For hand-to-hand transactions I would prefer Tangem card. It's cheaper and reusable.

I'd never heard of these before, but they look great. Are they fairly new? Really sleek design. A nice, straightforward way to make off chain transactions and to gift bitcoin to friends who don't have their own wallet yet. An open source app and a good security audit. I might pick up a few of these.

Do you own any? How does it deal with change addresses? From the website it sounds like each card only stores a single private key. Does it just return unspent coins to the same address?

[igor72]

Do you own any? How does it deal with change addresses? From the website it sounds like each card only stores a single private key. Does it just return unspent coins to the same address?

No, I don't own Tangem card. I think you're right, the change returns to the same address. But I can't say for sure.

[squatter]

Do you own any? How does it deal with change addresses? From the website it sounds like each card only stores a single private key. Does it just return unspent coins to the same address?

No, I don't own Tangem card. I think you're right, the change returns to the same address. But I can't say for sure.

It must. From the FAQ, each card indeed only holds a single private key:

Each Tangem Card is fixed to a certain cryptocurrency and can hold one private key at a time.

I'm not a fan of the privacy implications of address reuse, but the idea of a bearer instrument that you can also spend from is pretty exciting. At $13, they are cheaper than OpenDimes (by a hair) but offer a much slicker look and better functionality.

Does anyone know about the company behind them? The site has only been up for a few months.

[Pmalek]

Does anyone know about the company behind them? The site has only been up for a few months.

There isn't much info about them.
The company is called Tangem AG. Their headquarters are in Switzerland.

You can find the addres on the official website, https://tangemcards.com/:
Global Headquarters, Tangem AG,
Baarerstrasse 10, 6300 Zug, Switzerland

It shows up on Google Maps as well.

You can find some more info about the company here:
https://www.uid.admin.ch/Detail.aspx?uid_id=CHE-390.112.525

[Abiky]

For hand-to-hand transactions I would prefer Tangem card. It's cheaper and reusable.

Nice. This looks like a better alternative to the OpenDime because of its sleek design and cheaper price. Sometimes I wonder how could this be reusable without compromising the security of the Bitcoin contained inside the card? If it's as they claim it to be, it'll be a blast to use for day-to-day Bitcoin transactions in a truly P2P manner. At least, the Tangem card has other cryptocurency options like ETH and XLM. As far as I know, the OpenDime is only available for BTC and LTC which greatly limits one's options for paying crypto using it as a bearer instrument.

Considering that the OpenDime or the Tangem card are not suitable for storing large amounts of Bitcoin on it, a hardware wallet is still the best thing around when you want to combine the convenience of hot wallets with the security of a cold wallet. The only downside is that hardware wallets like the Ledger and Trezor are somewhat expensive to acquire.

Nonetheless, bearer instruments like the OpenDime and the Tangem Card are best thing there is when it comes to making quick payments in-person "off-the-grid". But I'd highly recommend a hardware wallet anytime as they have greater advantages than the previously mentioned devices. Just my opinion

[DireWolfM14]

The Tangem card seems legit, but to be honest, I'm not seeing the allure.  I don't necessarily see it as alternative to the Open Dime, other than off-chain hand off.  It seems like it's marketed more as "mobile hardware wallet" that can also be used for off-chain transactions.  So, if you buy one for the NFC to phone function, you should ask yourself; are your funds any more secure than a hot wallet in a mobile app?  I don't think so, quite the contrary, in fact.  They specify in their faqs that unlike a hardware or mobile wallet, if the card is lost, so are the funds.  And therefor, you shouldn't keep a lot of bitcoin on the card.  Well, I don't leave a lot of cash in physical wallet, and I don't keep much bitcoin in my hot wallet.

But, if I lose my phone or it gets stolen, I can brick it as soon as I can find another phone to use.  I have a very strong PIN set on my mobile wallet, and it's different from the strong PIN set to get into my phone.  If I'm able to brick the phone in time, and I don't lose the funds in my hot wallet I'll be able to recover them.  No BTC lost, just the phone itself.

With the Tengem card you need to have your phone available, and you need to have the card available.  If you lose your phone then your card is useless, and if you lose your card your bitcoin is gone.  If you're like me, you probably also lost your cash, because your card was in your leather wallet and you lost the whole god damn thing.  So, you're left with no funds, and phone that can't send bitcoin.  In other words if you lose one or the other, you're fucked.  However, if I lose my wallet I still have my bitcoin I can spend.  If I lose my phone, I probably still have cash or credit cards in my pocket. As long as I don't lose both, I'm not fucked.

[o_e_l_e_o]

The only downside is that hardware wallets like the Ledger and Trezor are somewhat expensive to acquire.

I wouldn't say so. If you are willing to pay $15 for an OpenDime which you can use once, then paying $40-$60 for a Ledger Nano S (depending on what deals they have on at the time) which you can use as many times as you want for years on years hardly seems expensive to me.

So, if you buy one for the NFC to phone function, you should ask yourself; are your funds any more secure than a hot wallet in a mobile app?

Absolutely not. Whoever has possession of the card has possession of the funds. There is no way to back up a seed phrase or private key, and there is no way to apply a password or PIN. It is definitely less secure than a password protected mobile wallet. It is essentially the same as carrying cash. I don't carry much cash around with me either, but I still think it would be cool to be able to be able to physically hand someone $20 worth of BTC, for example, rather than make an on-chain transaction.

[DireWolfM14]

there is no way to apply a password or PIN.

To be fair, it looks like you can enable a pin:

**What if somebody scans my Card and transfers the funds from it?**

Not to worry - nobody will be able to transfer funds from your Card just by scanning it. Although checking the funds takes seconds, transferring them requires you to hold the Card against your phone for 15-30 seconds.

This is a security measure, its duration is configurable and it can be overridden by enabling a PIN-code on the Card (available on demand).

emphasis mine

It looks like you have to order the card with that option enabled, they say they say it's available on demand.  That seems like feature that should come as a default setting, and would be enabled or disabled using the app.

Otherwise, it takes holding the card against your phone for about 30 seconds or so.  It seems like someone could walk around in a crowd with the Tangem app running and scan people's pockets or purses for cards.  Once one is found, he could linger close enough to the card to extract the funds.

[o_e_l_e_o]

To be fair, it looks like you can enable a pin

Ahh good catch. I must have skimmed over that bit.

It seems like someone could walk around in a crowd with the Tangem app running and scan people's pockets or purses for cards.  Once one is found, he could linger close enough to the card to extract the funds.

That would be difficult I think. It says on the website it uses near field communication, which generally has a transmission distance of around 2-3 inches. That's not the same as radio frequency identification which is used to skim credit cards, which can have a range of a couple of feet. Once you factor transmission through a closed wallet and clothing, an attacker would probably have to hold their phone up against the person in question for 30 seconds or so, which seems unlikely to go unnoticed. Still, if you were really concerned about that, then I suppose you could buy an RFID blocking wallet.

[DaveF]

I use OpenDimes and I would not consider them a hardware wallet. More of a digital paper wallet.
Same with the Tangem cards.

Both are nice products for storing BTC and giving to people but there are not wallets.

But in the end are no different then a paper wallet with a sticker over the private key.
Once it's opened, it's out there in the open.

-Dave

[Tibu]

For those who are looking at OpenDime because of the good price and the low form factor, you can have a nice alternative with Satochip card.
Which are also cheap compare to other well know hardware wallet and offer a real "hardware" alternative because keys are stored within a secured chip and never leave it!


This is the LTC version of the hardware wallet... Nice looking and fit in your purse.


------------------------------------ Useful links ------------------------------------
Official BTCTalk thread: https://bitcointalk.org/index.php?topic=5181719.msg52357835#msg52357835
On Twitter: https://twitter.com/SatochipWallet
On Telegram: https://t.me/Satochip
Website: https://satochip.io

[Zicadis]

For those who are looking at OpenDime because of the good price and the low form factor, you can have a nice alternative with Satochip card.
Which are also cheap compare to other well know hardware wallet and offer a real "hardware" alternative because keys are stored within a secured chip and never leave it!

Not really sure how you can market this as an alternative to OpenDime considering the OpenDime is $14 each and single use, whereas your wallet is $27 and multi-use?

They clearly serve two different audiences, one for absolute noobs whereas yours appears to be for intermediate users...

Maybe you could compete with OpenDime if you sold yours in packs of three for a slightly lower price, maybe $50 or so?

[o_e_l_e_o]

The Satoship isn't a direct competitor to the OpenDime as it is not designed to be physically handed from one person to another. It is more of a competitor to the "standard" hardware wallets like Ledger or Trezor devices. Although inexpensive and sleek looking, the big downside is that you have to buy and carry around a bulky card reader as well, so it doesn't exactly fit in your wallet as you would expect.

[DaveF]

The Satoship isn't a direct competitor to the OpenDime as it is not designed to be physically handed from one person to another. It is more of a competitor to the "standard" hardware wallets like Ledger or Trezor devices. Although inexpensive and sleek looking, the big downside is that you have to buy and carry around a bulky card reader as well, so it doesn't exactly fit in your wallet as you would expect.

But it does look cool.
American Express tried something like this years ago when they launched the blue card.
Plug a usb reader into your computer to make online purchases. Was supposed to be more secure.
Don't know if it was or not, but it never was that popular.


https://web.archive.org/web/20081207004902/http://bits.blogs.nytimes.com/2008/12/05/a-credit-card-loses-its-high-tech-cred/

-Dave

[o_e_l_e_o]

But it does look cool.

Totally, and I've actually been meaning to pick one up for a while just to play around with it. I've got no issue plugging a card reader in to my desktop at home, or even carrying one around in my laptop bag. I am not, however, going to carry one around in my pocket for transacting on the move. The whole point of a wallet shaped like a credit card, in my opinion, is that it can be carried around inside your fiat wallet like a credit card. If Satochip incorporated bluetooth, RFID, NFC, or some other secure wireless transmission capabilities, I would almost certainly use one for my day to day crypto spending rather than a mobile wallet or a different hardware wallet.

[Abiky]

I wouldn't say so. If you are willing to pay $15 for an OpenDime which you can use once, then paying $40-$60 for a Ledger Nano S (depending on what deals they have on at the time) which you can use as many times as you want for years on years hardly seems expensive to me.

Exactly. A hardware wallet can be re-used for as long as you like, while a bearer instrument like the Tangem Card or the OpenDime are one-time-use. They have their unique purposes for different situations in life. I already own a hardware wallet, but I'd love to get an OpenDime as a souvenir or collector's item. It's a great little device that I could use to send money to my friends personally if the need arises. Both the OpenDime and the Tangem Card are a great way to treat Bitcoin as "physical cash". I think they're much better than an ordinary paper wallet since the private keys are not exposed to prying eyes. Despite this, you're prone to losing your Bitcoin if the device gets lost/stolen while in a paper wallet it's much easier to make a backup of the keys.

Absolutely not. Whoever has possession of the card has possession of the funds. There is no way to back up a seed phrase or private key, and there is no way to apply a password or PIN. It is definitely less secure than a password protected mobile wallet. It is essentially the same as carrying cash. I don't carry much cash around with me either, but I still think it would be cool to be able to be able to physically hand someone $20 worth of BTC, for example, rather than make an on-chain transaction.

Yes. It's only great for small amounts of Bitcoin than anything else. One would treat these devices as you would with physical cash. But the true winner is the hardware wallet because of its greater degree of security (not to mention that it's also reusable). I'd say that both the Trezor One and the Ledger Nano X are neck-and-neck when it comes to providing unparalleled security with a wide-array of cryptocurrencies to choose from. Still, I doubt how secure the Ledger Nano X would be considering that it relies on Bluetooth connection for interacting with it. It's the reason why I've kept my Ledger Nano S for a long time. Which is why, I'm not planning to switch to another hardware wallet until my good-old hardware wallet dies for good.

[o_e_l_e_o]

I think they're much better than an ordinary paper wallet since the private keys are not exposed to prying eyes. Despite this, you're prone to losing your Bitcoin if the device gets lost/stolen while in a paper wallet it's much easier to make a backup of the keys.

Yeah, although these devices are closer to a paper wallet in similarities than they are to classical hardware wallets, they still don't fulfill the same purpose. I have a couple of paper wallets I use for long-term cold storage, because they are very secure and easy to back up by creating multiple copies. This isn't possible with an OpenDime or Tangem card. Similarly, you can't really use paper wallets as cash, since the receiving party has absolutely no way to know whether you created the paper wallet securely, or whether you have another copy of the wallet which you can use to then rip them off.

I'd say that both the Trezor One and the Ledger Nano X are neck-and-neck when it comes to providing unparalleled security with a wide-array of cryptocurrencies to choose from.

That certainly used to be the case, but since the security flaws in the Trezor discovered by Ledger and Kraken, I have stopped using my Trezor devices. Ledger certainly has the lead with the current devices on the market.

Still, I doubt how secure the Ledger Nano X would be considering that it relies on Bluetooth connection for interacting with it.

It doesn't rely on Bluetooth, as you can disable it entirely and use a USB-C cable instead if you want. Only public data is transmitted via Bluetooth anyway - an unsigned transaction from phone to wallet, and a signed transaction back from wallet to phone - and even then it is encrypted. As far as I know, no one has demonstrated any potential security risk from using Bluetooth. There's more info here: https://www.ledger.com/ledger-nano-x-bluetooth-security-model-of-a-wireless-hardware-wallet/

[Abiky]

Yeah, although these devices are closer to a paper wallet in similarities than they are to classical hardware wallets, they still don't fulfill the same purpose. I have a couple of paper wallets I use for long-term cold storage, because they are very secure and easy to back up by creating multiple copies. This isn't possible with an OpenDime or Tangem card. Similarly, you can't really use paper wallets as cash, since the receiving party has absolutely no way to know whether you created the paper wallet securely, or whether you have another copy of the wallet which you can use to then rip them off.

Yes. I've figured that the real deal about the OpenDime or the Tangem Card is making a backup of their private keys. Considering the way they've been designed, it's practically impossible to do this without "breaking the seal". In this regard, paper wallets are a winner. By all means, I'd treat bearer instruments as they were physical cash. That's because if you lose them, there's no way to recover your funds unlike a hardware wallet. For different situations/scenarios, you'd choose one type of wallet from the other. As for me, I'd choose both a bearer instrument like the OpenDime and a hardware wallet like the Ledger Nano S for added convenience.

That certainly used to be the case, but since the security flaws in the Trezor discovered by Ledger and Kraken, I have stopped using my Trezor devices. Ledger certainly has the lead with the current devices on the market.

I wonder if Trezor managed to address those flaws already? If it wants to stay in the competition, I'd need to focus on securing its devices against external attacks. But if they haven't mitigated the issue yet, then I believe that the "Ledger" company will prevail in the long run. I believe that "Ledger" is the most trusted hardware wallet manufacturer in existence, with a proven track record of security and reliability. I like its hardware wallets the most as they're much more compact than the Trezor. Both are neck-and-neck in terms of providing a wide-array of cryptocurrencies to choose from. But the Ledger will always be a winner in my book.

It doesn't rely on Bluetooth, as you can disable it entirely and use a USB-C cable instead if you want. Only public data is transmitted via Bluetooth anyway - an unsigned transaction from phone to wallet, and a signed transaction back from wallet to phone - and even then it is encrypted. As far as I know, no one has demonstrated any potential security risk from using Bluetooth. There's more info here: https://www.ledger.com/ledger-nano-x-bluetooth-security-model-of-a-wireless-hardware-wallet/

I did not know about that earlier. Thanks for clarifying. If that's the case, then it would be worth doing the upgrade from the Nano S to the newly-released Nano X. After all, the new version has greater capacity for installing various crypto apps at the same time. As an avid crypto user, I often use more than one cryptocurrency for trading and long-term storage. The Nano S is very limited compared to the Nano X as you cannot install more than 3-4 apps at the same time because of its memory limitations.

Despite this, there's no denying that hardware wallets are better than bearer instruments like the ones mentioned previously. As it's said in the real world, "you get what you pay for". Bearer instruments like the OpenDime and the Tangem Card may be cheaper than hardware wallets like the Ledger or the Trezor but they're not "bulletproof". They're only great for sending small amounts of crypto to friends and family in a physical manner. Even though they're inferior than hardware wallets, I'd certainly love to own an OpenDime and Tangem Card as a sort of "souvenir" or "collector's item".

[o_e_l_e_o]

I wonder if Trezor managed to address those flaws already?

They haven't, unfortunately. There was a discussion about this on another thread while back. Essentially the attack is at a hardware level, so isn't fixable/patchable with a software update - it will take an entire redesign and new model being released to fix it. The attack is mitigated by using a long, random passphrase. Essentially, the seed is still at risk of being stolen, but if you are also using a passphrase then at least your coins won't be stolen. However, Trezor's response to the whole thing has been wholly unsatisfactory in my opinion. They have released a couple of blog posts which essentially say "Meh, use a passphrase", but do nothing to address the underlying concerns of their users. They don't mention the requirement to use a passphrase to new users in any of the documentation, they haven't made any attempt to contact existing users about the vulnerability, and there is no mention of it on their main website. They seem to be trying to just sweep it under the rug, and hoping nothing bad comes from it.

I stopped using my Trezor devices partly because of the vulnerability, but also partly because of their attitude to it. I no longer trust them.

[Pmalek]

They seem to be trying to just sweep it under the rug, and hoping nothing bad comes from it.

That is exactly what they are doing. Hoping that with enough time people will simply forget about it. Until the Ledger team revealed the problem to them they either didnt know about it or didn't care to mention it to the public. New users probably don't know about the issues, unless they did extensive research on the product, and lets be honest, most probably they didn't. 

[o_e_l_e_o]

Hoping that with enough time people will simply forget about it.

They might get lucky, and no one will have their coins stolen by this method before their next model is designed, released, and becomes widespread (I am assuming of course they will fix the issue in question when they inevitably do release a new model - it would be crazy not to). Having said that, however, they only need a single user to lose a significant amount of coins via this method for it to explode all over Twitter, Medium, Reddit, this forum, etc., and cause significant damage to their reputation and their profits. It's a very large risk they are taking, especially when it can be mitigated quite easily.

If it were me, I would send an email to all the customer addresses they have, explaining the vulnerability and stating how to protect against it. I would put an announcement on their social media channels, on their web page, and I would include a section in their set-up guide explaining that it is highly recommended for all users to use a (complex) passphrase. Anything short of that is highly irresponsible on their part.

[DaveF]

I have said it in other posts here but since it came up I will say it again.
It's the attitude in general of Slush.
Problems with the pool back in the day, sweep it under the rug and ignore it.
More issues with payouts from the pool and other things, ignore it.
Trezor security issues, ignore it.

It's just the way they do things.

-Dave

[DireWolfM14]

I'm no expert, but I think that the security issues with Trezor (and similar wallets like KeepKey) are over-hyped.  It's my opinion that no hardware wallet should be used without a Bip39 pass phrase, and that includes the Ledger.  By simply using a Bip39 pass phrase, your seed alone becomes worthless.  Unless the hacker knows your pass phrase your bitcoin is safe, at least for a brief period of time, depending on the complexity of the pass phrase.  Hopefully this will provide you enough time to notice your wallet has been lost or stolen.

It's my understanding that in order to hack the Trezor to obtain the seed-phrase the hacker needs to have the wallet in hand (i.e. physical attack,) and he must know the PIN.  Even the strongest PINs are vulnerable to brute force, being composed of numbers only.  Like Ledger models, both Trezor wallets have a security feature that wipes the device if the wrong PIN is entered three times.

According to the Kraken Labs article:

We then crack the encrypted seed, which is protected by a 1-9 digit PIN, but is trivial to brute force.

So, one can reason that if the PIN on a Trezor is trivial to brute-force, then why would the PIN on a Ledger be any more secure?  In fact, I would suggest that if one can brute-force your Ledger PINs then your coins are more at risk.  I'm assuming that anyone who has set up a Bip39 pass phrase on their Ledger has also attached it to a secondary PIN (which should also be "trivial" to brute force.)  The secondary PIN is a pretty cool feature that the Ledger offers, and helps to save time when accessing your wallet, but wouldn't that compromise the added security of having a strong pass phrase?

Again, I'm only hypothesizing about something of which I have limited understanding.

[DaveF]

By simply using a Bip39 pass phrase

No you need a stupid long passphrase.

Take a look at this discussion:

https://bitcointalk.org/index.php?topic=5222188.0;all

-Dave

[DireWolfM14]

No you need a stupid long passphrase.

Of course the longer and more complex of a pass phrase you use the harder it is to crack, but even an eight-character pass phrase with unusual characters, numbers, upper, and lower case letters would take many years to crack. 

But that's not addressing my other concern about the Ledger and the use of a secondary PIN.  Regardless of how stupid-long your pass phrase is, hiding it behind a 9-digit numeric PIN would defeat the purpose, no?

[o_e_l_e_o]

It's my understanding that in order to hack the Trezor to obtain the seed-phrase the hacker needs to have the wallet in hand (i.e. physical attack,) and he must know the PIN.  Even the strongest PINs are vulnerable to brute force, being composed of numbers only.  Like Ledger models, both Trezor wallets have a security feature that wipes the device if the wrong PIN is entered three times.

An attacker must have physical access to the wallet, yes. However, in the attack as detailed by the Ledger Donjon team here (https://donjon.ledger.com/Unfixable-Key-Extraction-Attack-on-Trezor/), the PIN is bruteforced at a hardware level, meaning the security features of a prolonged delay between attempts or locking the device if too many wrong attempts are made are bypassed. The PIN is brute forcible in a matter of minutes.

So, one can reason that if the PIN on a Trezor is trivial to brute-force, then why would the PIN on a Ledger be any more secure?

There has been no similar attack demonstrated on a Ledger device in which the 3-strikes-and-you're-out PIN protection system has been able to be bypassed.

I'm assuming that anyone who has set up a Bip39 pass phrase on their Ledger has also attached it to a secondary PIN (which should also be "trivial" to brute force.)

I've never used the "attach to secondary PIN" feature, but it would still be secure unless a similar attack was demonstrated as above.

[Abiky]

They haven't, unfortunately. There was a discussion about this on another thread while back. Essentially the attack is at a hardware level, so isn't fixable/patchable with a software update - it will take an entire redesign and new model being released to fix it. The attack is mitigated by using a long, random passphrase. Essentially, the seed is still at risk of being stolen, but if you are also using a passphrase then at least your coins won't be stolen. However, Trezor's response to the whole thing has been wholly unsatisfactory in my opinion. They have released a couple of blog posts which essentially say "Meh, use a passphrase", but do nothing to address the underlying concerns of their users. They don't mention the requirement to use a passphrase to new users in any of the documentation, they haven't made any attempt to contact existing users about the vulnerability, and there is no mention of it on their main website. They seem to be trying to just sweep it under the rug, and hoping nothing bad comes from it.

I stopped using my Trezor devices partly because of the vulnerability, but also partly because of their attitude to it. I no longer trust them.

If they don't care about fixing the issue, then they don't care about their customers at all. I detest businesses with such malpractices. That's why I'm better off using Ledger's hardware wallets since they're tried-and-tested over the years. Not to mention, Ledger is very trusted in crypto land. Trezor could lose its business if sometime in the future, someone gets its funds hacked from the hardware wallet itself. The customer could sue the Trezor company by not taking due responsibility in patching/fixing the device's vulnerabilities. Then, it'll be the end of the road for Trezor as we know it. As long as no one has experienced an undesired situation with Trezor's hardware wallets, the company will not care about fixing the situation beforehand.

Besides, there are many other hardware wallet manufacturers out there in the crypto/Blockchain industry. Apart from Ledger, other companies like KeepKey, and ColdWallet provide hardware wallet solutions for crypto users. The more hardware wallet manufacturers there are, the greater the competition (which tends to be good news for the end user).

I'll stick with my Ledger Nano S hardware wallet until it dies. I've noticed that the screen is becoming dimmer (or fading) over time. This might be an indication that the device needs to be replaced soon. It has lasted for quite a few years now, so I'd say it's worth every penny.

That is exactly what they are doing. Hoping that with enough time people will simply forget about it. Until the Ledger team revealed the problem to them they either didnt know about it or didn't care to mention it to the public. New users probably don't know about the issues, unless they did extensive research on the product, and lets be honest, most probably they didn't. 

The real problem will be newcomers into cryptocurrency as they're not aware of how everything works in the space. They'd simply use the Trezor normally without doing their own research. Rest assured that if any of these noobs lose their funds because of Trezor's negligence, things will start taking up heat. I wouldn't be surprise to see a class-action lawsuit sometime in the future, if many people start losing their hard-earned crypto funds as a result of company mismanagement. As long as nobody loses their coins, the company won't care about mitigating said vulnerabilities on its devices. Luckily, there are many other alternatives out there on the market which gives us peace of mind.

So far, Ledger hardware wallets are #1 in terms of security and reliability. It's the best thing around when you want to enjoy the convenience of a hot wallet and a cold wallet. I'd highly recommend it over bearer instruments like the OpenDime or the Tangem Card for large amounts of crypto. If you just want to send crypto to another person in a physical manner, then these bearer instruments are an affordable way to do it. I'd personally use both a hardware wallet and a bearer instrument for added convenience.

[o_e_l_e_o]

The customer could sue the Trezor company by not taking due responsibility in patching/fixing the device's vulnerabilities.

Well, that's the issue. It's a hardware fault, not a software one, so there is no way to patch or fix it. They will have to design and release a whole new device.

Apart from Ledger, other companies like KeepKey, and ColdWallet provide hardware wallet solutions for crypto users.

Be aware that since KeepKey is based upon the Trezor, they also suffer from the same vulnerability.

I've noticed that the screen is becoming dimmer (or fading) over time.

I've seen a couple of users on here saying the same thing. I've also had my original Ledger device for years and not noticed any fade, but I've since added to my collection with several more as back ups, so if it does eventually fail then no harm done. As you say, $40 for several years of use is not unreasonable by any means.

[Abiky]

Well, that's the issue. It's a hardware fault, not a software one, so there is no way to patch or fix it. They will have to design and release a whole new device.

Designing a new hardware device with the purpose of addressing certain vulnerabilities may not be cost-effective for the company. But if it wants to stay in business, this is the way to go. I'm admired by how Ledger quickly addresses issues within its devices. It's no wonder why it's trusted by many people worldwide. While the Trezor One has all the bells and whistles (like a Touchscreen), it's not as popular as the Ledger Nano S or the Nano X. I'd definitely upgrade my Nano S to the newest version once it dies. For a couple of years since I've bought it, I'd say that it's a long-lasting device that's worth every penny.

The Nano S has been reduced in price over time as a result of the Nano X's release on the market. For only $40, you can safely and securely store your crypto for piece of mind. It's better than a paper wallet, and much more versatile than a bearer instrument like the OpenDime or the Tangem Card. Still, each device has its own use cases for the mainstream world. At least, prices are affordable which allows the "unbanked" to get access to the world of crypto in an easy way.

Be aware that since KeepKey is based upon the Trezor, they also suffer from the same vulnerability.

I was not aware about that. Thanks for letting me know. For some time, I was considering to buy this device for a friend. I've thought that it was battle-tested like the Ledger, but now you've proved me wrong. I have to say that no other hardware wallet out there on the market matches the Ledger. Its unmatched security and durability, its what has kept it on the top for so many years. I wouldn't be surprised to see its competitors losing ground in the future as a result of Ledger's success.

I've seen a couple of users on here saying the same thing. I've also had my original Ledger device for years and not noticed any fade, but I've since added to my collection with several more as back ups, so if it does eventually fail then no harm done. As you say, $40 for several years of use is not unreasonable by any means.

It's a good thing to have more than one Ledger device that would serve as a backup in times of need. You can still get access to your crypto even if your Ledger dies if you've preserved your recovery seed/mnemonic. Even though my Ledger Nano S' LCD screen is fading, I can still see the on-screen text by putting it on the light. It's somewhat inconvenient, but at least the device is usable. If the screen fades completely, I'll be sure to grab a new Ledger Nano S as replacement. I'm tempted to get the Nano X, but it's somewhat expensive right now. It'll continue to use the Nano S model until the Nano X gets reduced in price over time.

I've been considering buying both an OpenDime and a Tangem Card for safekeeping. I'll fill them up with small amounts of Bitcoin to use them for paying in a P2P manner when there's no Internet connection. They make a great collector's item or souvenir for any crypto enthusiast. I personally like the Tangem Card as it has a wide-variety of cryptos to choose from. There's a card for Ethereum, and Bitcoin which are my most favorite cryptocurrencies right now. They'll go great with my ever-growing collection of crypto items.

[malevolent]

The real problem will be newcomers into cryptocurrency as they're not aware of how everything works in the space. They'd simply use the Trezor normally without doing their own research. Rest assured that if any of these noobs lose their funds because of Trezor's negligence, things will start taking up heat. I wouldn't be surprise to see a class-action lawsuit sometime in the future, if many people start losing their hard-earned crypto funds as a result of company mismanagement. As long as nobody loses their coins, the company won't care about mitigating said vulnerabilities on its devices. Luckily, there are many other alternatives out there on the market which gives us peace of mind.

Hasn't happened so far so I doubt we will be seeing 'many' users losing their money due to this. Not a single person has shown up to say they lost anything because someone stole their Trezor and they had no passphrase or too weak a passphrase. I'm sure most people who keep a large amount of money on their Trezor use a secure passphrase anyway.

Satoshi Labs should have done more to inform their customers about the security of their Trezors but the risk is overstated.

[DaveF]

Satoshi Labs should have done more to inform their customers about the security of their Trezors but the risk is overstated.

Not to bash your opinion, but I think your post really should say "Satoshi Labs should have done SOMETHING to inform their customers about the security of their Trezors"

I think that is what is the more serious issue.

They have known about it for months, but you go and but a new one from them the need for a complex password is STILL not mentioned anyplace obvious it the docs.

That is where the issue is.

Keep safe out there.

-Dave

[Abiky]

Hasn't happened so far so I doubt we will be seeing 'many' users losing their money due to this. Not a single person has shown up to say they lost anything because someone stole their Trezor and they had no passphrase or too weak a passphrase. I'm sure most people who keep a large amount of money on their Trezor use a secure passphrase anyway.

Satoshi Labs should have done more to inform their customers about the security of their Trezors but the risk is overstated.

Good to know. As long as people use strong passphrases for Trezor devices, nothing can go wrong. It's yet the time where no one has experienced issues with them (like the loss of funds), so the company would have no reason fix the aforementioned vulnerabilities on new devices. But I'm better off using tried-and-tested Ledger devices since the company focuses heavily on security than anything else.

I've been considering other hardware wallet options like the CoolWallet S and the FuzeW Wallet. They have a "credit card" form factor, which means that they easily fit on your everyday wallet. I'm not sure how secure these wallets are, but they're a convenient way to carry crypto with you on the go. The only downside is that they're powered by an internal battery, when that's not the case with the Ledger Nano S or the Nano X. My concern is that once the battery dies, you'll have to dispose the device as it becomes useless. Even if my Ledger Nano S' screen is fading, it'll still be usable without it by using the internal buttons. I'm often looking for durability and security, so I'm wondering how these credit card sized hardware wallets will perform over time.

Anyhow, I'll stick with my Ledger Nano S until it dies completely. The OpenDime could be a great addition to my arsenal in case I want to send Bitcoin to another person in a physical manner. With a cost of only $35 per "stick", I'd say the OpenDime doesn't break the bank.

[malevolent]

My concern is that once the battery dies, you'll have to dispose the device as it becomes useless.

It often takes a long time for a device's battery to completely crap itself out, usually it just loses its capacity, and since these wallets last a long time on a single charge, even losing 80% of the battery's capacity won't make using it too inconvenient.

[DaveF]

So because of this thread I ordered some Tangem cards



Look nice. The RFID is a bit weak IMO. My phone reads a lot of other RFID cards easier then this.
With that being said I do not know if it's something in the app that they use doing something odd with the read that is causing it to ask to scan multiple times.
Other (non crypto) apps reading other cards just tap and it's there.

The app is nice, and I can see this as a nice way to pass someone a known amount of BTC (or ETH since I got one of those cards too) without worry.

Stay safe.

-Dave

[Abiky]

It often takes a long time for a device's battery to completely crap itself out, usually it just loses its capacity, and since these wallets last a long time on a single charge, even losing 80% of the battery's capacity won't make using it too inconvenient.

Thanks. It seems that the battery of the Nano X lasts for a very long time. As long I'm able to use the device for a couple of years, nothing else matters. My Ledger Nano S is dying (screen very dim) so upgrading to the new version would be ideal. A great thing about hardware wallets (especially the ones offered by Ledger) is that they're durable, reliable, and extremely secure to use. They may be expensive than other solutions (paper wallets, bearer instruments like the OpenDime or Tangem Card, software wallets, etc.), but I'd say they're worth every penny.

I've been looking into other hardware wallets for Bitcoin, and I've found one called the "ColdCard" by Coinkite. It looks like a little calculator, yet it seems to do its job well for securing Bitcoin transactions on the go. What I like most about this device is that you can make offline transactions with it. It works on its own (standalone) without the need of a computer or mobile device. The only thing is the price, but if it works as intended, it's a great alternative to the Ledger, Trezor, or other hardware wallets on the market today.

So because of this thread I ordered some Tangem cards

..

Look nice. The RFID is a bit weak IMO. My phone reads a lot of other RFID cards easier then this.
With that being said I do not know if it's something in the app that they use doing something odd with the read that is causing it to ask to scan multiple times.
Other (non crypto) apps reading other cards just tap and it's there.

The app is nice, and I can see this as a nice way to pass someone a known amount of BTC (or ETH since I got one of those cards too) without worry.

Stay safe.

-Dave

The cards looks great. I'd personally buy it as a souvenir or collectible, than using it seriously for crypto payments. The RFID chip may be weak, but at least the phone is able to recognize the card. What I like most about the Tangem Card is its variety of crypto offerings including (but not limited to) Bitcoin, Ethereum, XRP, and more. The OpenDime is only limited to Bitcoin and Litecoin, so the Tangem Card has an advantage here.

I wonder if the Tangem Card's level of security has been put up to the test? I've seen that it's possible to steal information from RFID chips using a RFID scanner. Just like anyone with an RFID scanner is able to steal your credit card information (if it has an RFID chip), the same could be done with the Tangem Card. Unless the card itself has some level of encryption, I don't see it as a viable solution for storing crypto in the long term. It's always recommended to store small amounts of crypto on bearer instruments like the OpenDime or Tangem Card just to be safe. For serious crypto use, hardware wallets are unmatched for now.

[DaveF]

I wonder if the Tangem Card's level of security has been put up to the test? I've seen that it's possible to steal information from RFID chips using a RFID scanner. Just like anyone with an RFID scanner is able to steal your credit card information (if it has an RFID chip), the same could be done with the Tangem Card. Unless the card itself has some level of encryption, I don't see it as a viable solution for storing crypto in the long term. It's always recommended to store small amounts of crypto on bearer instruments like the OpenDime or Tangem Card just to be safe. For serious crypto use, hardware wallets are unmatched for now.

According to the FAQ on Tangem:

What if somebody scans my Card and transfers the funds from it?

Not to worry - nobody will be able to transfer funds from your Card just by scanning it. Although checking the funds takes seconds, transferring them requires you to hold the Card against your phone for 15-30 seconds.

This is a security measure, its duration is configurable and it can be overridden by enabling a PIN-code on the Card (available on demand).

So you can have some protection. The issue I see is that you NEED the Tangem app to unload that card. They disappear in the middle of the night that could be an issue.
You can't even get your private key from the card.
Once again from their FAQ:

How can I backup the private key?
You can neither import the private key into a Tangem Card nor export the private key -- so it’s completely impossible to have a copy. The architecture of each Tangem Card guarantees the chip inside is the only place in the universe where the unique key can ever be located.

But yeah, they are nice looking. Part of why I bought them. Never going to store any crypto on them. It's not 100% not your keys not your coins but it's close.

-Dave

[HCP]

I'm not sure about this part:

Who knows the private key?

Each Tangem Card holds a secure chip that allows you to store and carry digital assets. The private key is generated by and permanently stored within the chip. Nobody has access to it either during or after the manufacturing process. This means that nobody can input, export or make a copy of this key.

So, it appears that the Tangem card cannot be "reset" to regenerate a new key... instead it just arrives "as-is" with a preloaded key? That seems... "problematic".

Still, they look nice

[DaveF]

So, it appears that the Tangem card cannot be "reset" to regenerate a new key... instead it just arrives "as-is" with a preloaded key? That seems... "problematic".

Still, they look nice

In that way they are closer to the opendime then a true hardware wallet.
A better way of thinking about it is a rfid security device that you must have to send bitcoin.
What I did not know (because I did not read they do not hide it) is that you can never get the private key.

Need to sign a message. Nope, not from what I can see in the app.
Another shitfork comes out, can't claim it.
etc.

-Dave

[HCP]

Need to sign a message. Nope, not from what I can see in the app.
Another shitfork comes out, can't claim it.

That's a good point actually... it really is borderline "not your keys", almost to the point of "custodial" except, theoretically, no-one has access to the keys...

Having said that, I guess the point of these cards isn't really to be a long term HODL type device... more a way you can load up some coins and pass them onto someone in a relatively secure (offline) way.

[figmentofmyass]

Need to sign a message. Nope, not from what I can see in the app.
Another shitfork comes out, can't claim it.

That's a good point actually... it really is borderline "not your keys", almost to the point of "custodial" except, theoretically, no-one has access to the keys...

we have to trust their closed source firmware for that to be true, the risk mitigation being that it was audited by a third party company:

The security of Tangem technology is audited by the Kudelski Group, a listed Swiss security company. The report is available here.

that's enough to make me cautious. i would also be slightly worried about physical integrity. i really don't like the idea of having zero back-ups. it has a sweet design though, very slick looking.

[Abiky]

...

So you can have some protection. The issue I see is that you NEED the Tangem app to unload that card. They disappear in the middle of the night that could be an issue.
You can't even get your private key from the card.

...
-Dave

That's a huge concern for those looking to use Tangem cards as a long-term storage for crypto. Since you don't control the private key, you don't truly own the funds. This bearer instrument is only useful for small amounts of crypto or doing quick transactions between peers. If you're looking to store large amounts of crypto, then hardware wallets are your best option.

What I like most about the Tangem cards is their cheap price (and design) compared to other crypto wallets. They make great souvenirs or collectibles that might be worth a ton of money in the future (if they become extremely rare). The Tangem team should've made the app open source so that people who kept their cards for safekeeping, could use them in the future even if the company ceases operations in the long term.

As for the OpenDime, I don't think this will be a concern since data is stored locally on the device without the need to interact with a separate app to read the private key. You could hold your OpenDime for years without worries. The OpenDime could be a true winner in this regard, unless the Tangem team decides to provide an "exit route" to users if they decide to disappear in the middle of the night.

That's a good point actually... it really is borderline "not your keys", almost to the point of "custodial" except, theoretically, no-one has access to the keys...

Having said that, I guess the point of these cards isn't really to be a long term HODL type device... more a way you can load up some coins and pass them onto someone in a relatively secure (offline) way.

Yeah. I wouldn't use Tangem cards for serious long-term storage of crypto, except for performing quick transactions with it. Different types of wallets have their unique purposes in real life. Those looking for a reliable long-term cold storage for their crypto will simply use a paper wallet or a hardware wallet, while those who want to send crypto offline quickly will use an OpenDime or Tangem card.

Nonetheless, hardware wallets are ten times better than the OpenDime but they're relatively expensive. People who cannot afford a hardware wallet could simply use an OpenDime over a software wallet for added security without breaking the bank. At least, we have many options to choose from.